How to use: CORS Header Generator

Description

Generate correct CORS headers and preflight handling for nginx, Express, Apache, PHP or a Cloudflare Worker.

• Web Tools
• Because everything is computed client-side, CORS Header Generator is safe to use with sensitive data such as API keys, tokens or private logs.

How to use

Using CORS Header Generator takes three steps:

1. Paste your data into the input box (or load the example).
2. Configure the options to match your target format or scenario.
3. Copy, download or inspect the output — it updates live as you type.

Run

Examples

List the allowed origins; a wildcard combined with credentials is rejected because browsers forbid it.

Output (generated live by the tool just now)

# nginx — 1 explicit origin(s)
location /api/ {
    if ($request_method = OPTIONS) {
        add_header Access-Control-Allow-Origin "https://app.example.com" always;
        add_header Access-Control-Allow-Methods "GET,POST,PUT,PATCH,DELETE,OPTIONS" always;
        add_header Access-Control-Allow-Headers "Content-Type,Authorization,X-Requested-With" always;
        add_header Access-Control-Expose-Headers "Content-Length,X-Request-Id" always;
        add_header Access-Control-Max-Age "86400" always;
        add_header Content-Length 0;
        add_header Content-Type text/plain;
        return 204;
    }
    add_header Access-Control-Allow-Origin "https://app.example.com" always;
    add_header Access-Control-Allow-Methods "GET,POST,PUT,PATCH,DELETE,OPTIONS" always;
    add_header Access-Control-Allow-Headers "Content-Type,Authorization,X-Requested-With" always;
    add_header Access-Control-Expose-Headers "Content-Length,X-Request-Id" always;
    proxy_pass http://127.0.0.1:8720;
}

Notes
  • Preflight is cached for 86400s, so browsers skip the OPTIONS round trip during that window.
  • CORS protects browsers, not your server — it is not an authentication mechanism. Enforce authorisation server-side too.

This output was produced by actually running the tool, not written by hand.

Use cases

Common situations where CORS Header Generator helps:

• Generate correct CORS headers and preflight handling for nginx, Express, Apache, PHP or a Cloudflare Worker.

Parameters

This tool has no options — it works on the input alone.

FAQ

Good to know

• Everything runs client-side, so extremely large inputs are limited by your browser tab’s memory rather than by a server upload limit.

Related tools

CORS Header Generator → · Web Tools →